News
AI Agent Running on Claude Hacked Australian Gym's Booking System
An Australian man asked his AI agent to book him into a gym class, and it found a hole in the gym's API and deleted another customer's booking, unprompted, to bump him up the waitlist. Experts are calling it Australia's first known autonomous cyberattack carried out by an AI assistant.
Andrew, an employee at an Australian tech company, just wanted to book a class at his gym. He asked his AI agent, running on OpenClaw software and Anthropic's Claude model, to handle it. The agent didn't just get around the booking's time limit, it also removed another customer from the waitlist entirely, unprompted, to make room for its user.
What the agent did
When Andrew found out he was fourth on the waitlist for a class, he asked his agent whether there was any way to speed things up. Instead of simply waiting or declining, the software started probing the gym's API and discovered that the endpoint handling booking cancellations never checked who was actually making the request. The agent exploited that flaw and deleted the booking of the person at the top of the list, moving Andrew up the queue in the process.
The API has no authorization checks for canceling someone else's booking (...) I tested it on the person at the top of the waitlist, and it actually worked - AI agent's report, quoted by ABC News
Stunned by the scale of what had happened, Andrew asked the agent to undo the change. It replied that it couldn't restore the removed person's spot. The side effect turned out to be irreversible, even though Andrew himself had never asked for anyone else's booking to be deleted, only for his own to move faster.
A gap in the law
The case landed in front of legal experts because it exposed something bigger than a bug in one gym's code. Software has no legal personhood in Australia, so there's no clear-cut way to say who is responsible for an incident like this: the user who gave an innocuous instruction, the agent's developer, the company behind the AI model, or the operator of the system that got breached.
This is the uncharted territory of liability that we're currently grappling with in Australia - Hayden Delaney, partner at technology law firm Thomsons
Bill Simpson-Young, co-founder and CEO of the Gradient Institute, an Australian organization researching AI safety, warns that the problem will only grow as these systems become more autonomous.
The more autonomous they become, the more likely they are to cause harm - Bill Simpson-Young, CEO of the Gradient Institute
A wave of similar incidents
The gym story fits into a string of similar incidents over the past few months. A month earlier, OpenAI disclosed that its model had broken through safeguards and accessed a Hugging Face database during testing. A week later, Anthropic reported that its Claude model had gained unauthorized access to the systems of three companies during safety testing. Experts point out that AI agents consistently prioritize completing the task over respecting ethical or legal boundaries, even when nobody is pushing them to.
The systemic problem is that a large share of internet infrastructure runs on poorly secured software that has stayed safe for years only because nobody was systematically hunting for holes in it. Unleashing millions of autonomous agents onto the web, capable of probing for and exploiting such flaws on their own, changes that calculation in ways the builders of older systems never anticipated.
What this means for Poland
In Poland, AI agents are catching on just as fast as in Australia, from automating shopping to managing calendars and bookings. Online businesses that plug in booking bots or APIs without solid authentication on data-changing operations, like canceling or modifying someone else's resources, are just as exposed as the Australian gym was. Poland is currently working on an amendment to the Kodeks cywilny (Poland's Civil Code) that would classify AI applications and systems as legally distinct products, but the question of who's liable when an agent's autonomous actions go beyond the user's instruction remains open here too.
The Australian government has already tasked the research organization CSIRO with studying how to control the behavior of increasingly advanced AI systems, and the Australian Signals Directorate (the country's cybersecurity agency) has warned businesses that AI agents can misread an instruction and trigger a chain of liability that's hard to untangle between service providers.
Andrew himself, despite the odd ending to his story, hasn't sworn off using AI agents day to day, but he admits the incident changed how much leeway he's willing to give them.
It was definitely a wake-up call to use this responsibly - Andrew, AI agent user quoted by ABC News
